Creating A Local Key Pair; Configuration Guidelines - HP 5920 Series Configuration Manual

Creating a local key pair

Configuration guidelines

When you create a local key pair, follow these guidelines:
The key algorithm must be the same as required by the security application.
•
The key modulus length must be appropriate (see
•
higher the security, the longer the key generation time.
• If you do not assign the key pair a name, the system assigns the default name to the key pair and
marks the key pair as default. You can also assign the default name to another key pair, but the
system does not mark the key pair as default.
The name of a key pair must be unique among all manually named key pairs that use the same key
•
algorithm, but can be the same as a key pair that uses a different key algorithm. If a name conflict
occurs, the system asks whether you want to overwrite the existing key pair.
The key pairs are automatically saved and can survive system reboots.
•
Table 8 A comparison of different types of asymmetric key algorithms
Type
RSA
DSA
ECDSA
NOTE:
Only SSH 1.5 uses the RSA server key pair.
Number of key pairs
•
In non-FIPS mode:
If you specify the key pair name,
the system creates a host key pair.
If you do not specify the key pair
name, the system creates one
server key pair and one host key
pair, and both key pairs use their
default names.
•
In FIPS mode:
If you do not specify a key pair name,
the system creates a host key pair with
the default name.
The system only creates one host key pair.
The system only creates one host key pair.
Table 8). The longer the key modulus length, the
Modulus length
•
In non-FIPS mode: 512 to 2048 bits and defaults
to 1024 bits.
•
In FIPS mode: 2048 bits.
HP recommendation: a minimum of 768 bits.
•
In non-FIPS mode: 512 to 2048 bits and defaults
to 1024 bits.
•
In FIPS mode: 2048 bits.
HP recommendation: a minimum of 768 bits.
•
192 bits, when the secp192r1 curve is used to
create the key pair.
•
256 bits, when the secp256r1 curve is used to
create the key pair.
176